CVE-2026-80428 ILIAS-eLearning e.V. CVE debrief

Who should care

Administrators and users of ILIAS learning management system versions before 9.22, 10.10, and 11.3 should apply patches or upgrades to prevent unauthenticated remote code execution. This vulnerability has a high impact on confidentiality, integrity, and availability. Security teams should prioritize patching and monitor for suspicious activity. Operators of ILIAS systems should review their deployments and ensure they are running a patched version.

Technical summary

The ILIAS learning management system contains an unauthenticated PHP object injection vulnerability in versions before 9.22, 10.10, and 11.3. This vulnerability allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. The vulnerability has a CVSS score of 9.3 and is considered critical. Administrators should apply patches or upgrades to prevent unauthenticated remote code execution.

Defensive priority

Critical vulnerability in ILIAS learning management system allows unauthenticated remote code execution.

Recommended defensive actions

• Inventory and version checks for ILIAS installations
• Apply vendor patches or upgrades to versions 9.22, 10.10, or 11.3
• Implement compensating controls such as web application firewalls
• Monitor for suspicious activity and exception tracking
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The ILIAS learning management system versions before 9.22, 10.10, and 11.3 contain an unauthenticated PHP object injection vulnerability. This vulnerability allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Evidence is limited to CVE and NVD details. Defenders should verify ILIAS version deployments, review vendor patches, and assess exposure. Compensating controls like web application firewalls may be necessary until patches are applied. Monitoring for suspicious activity and exception tracking is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.